Vulnerabilitymedium
CVE-2026-91206: Apache Roller: Reflected XSS in the optional LDAP comment authenticator
AI summary · grok-4.7Summaries by Vani AI
Apache Roller 6.1.5 has a moderate reflected XSS in its optional LDAP comment authenticator.
Apache disclosed CVE-2026-91206, a reflected cross-site scripting flaw in Apache Roller 6.1.5. The optional LDAP comment authenticator writes request parameter values into its HTML form without proper neutralization. Apache rates it moderate, with CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation requires a victim to interact with a crafted link; no in-the-wild use is described.
Key facts
- Affects Apache Roller 6.1.5 only.
- Optional LDAP comment authenticator reflects request parameters into HTML.
- CVSS 3.1 base score is 6.1 (medium); user interaction required.
- No exploitation in the wild is reported.
- CVEs
- CVE-2026-91206
- Vendors
- Apache
- Products
- Apache Roller
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91206 | Reflected XSS in Apache Roller LDAP comment authenticator | 6.1 | — |
From the original article
Posted by David M. Johnson on Sep 25 Severity: Moderate CVSS 3. 1: 6.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.